Is there any api/programmatic way to determine the last update time of a NTFS volume? Thanks.
PS: I think may be it’s a file system question so nobody answered on ntdev. Reposting it here.
> Is there any api/programmatic way to determine the last update time of a NTFS volume? Thanks.
USN journal tracks all changes on a NTFS volume (if it’s turned on).
You may get the date of the last change from it, as well as
what change it was.
L.
Hi L, Thanks for the information. I looked for USN and I found out the various APIs etc that can be used to access the USN journal. My next questions are:
Q1. is it possible to know where this is USN journal is stored on the disk? Can this journal be opened for reading only in a text editor or as a file in a program using just without using any special windows API?
Q2. If my application turns this journal ‘ON’ on one of the machines and then if this physical drive is taken to some other windows machine and used there as secondary drive, will the changes made on the second machine be also tracked in the journal?
Thanks.